472f364680382069127e23278fd696740e00ea4f9aef8bffdbb4b98c87e84c82 | Triage

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/03/2024, 01:51

Sharing

Report Analysis Logs

General

Target

d79d03b4ac160fb01cf955786689271c.exe
Size

212KB
MD5

d79d03b4ac160fb01cf955786689271c
SHA1

c5c5f3bea55e265def713e5a9499688a0e737a67
SHA256

472f364680382069127e23278fd696740e00ea4f9aef8bffdbb4b98c87e84c82
SHA512

460b1907f11a8b84372e4d1dcd1c5004f2a0f59df35395867615b4b4a78b4dad35f7f01a03f91e465d4ea8830b5a95e56cb3c389c33a7ec0059b51f22cd0baca
SSDEEP

6144:1rRWlD39CXr/EwNj2r4k7ePhXMb/qMG0I:Y9CXrsaCr4kAXMb/xQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2692	1540	d79d03b4ac160fb01cf955786689271c.exe	28
PID 1540 wrote to memory of 2692	1540	d79d03b4ac160fb01cf955786689271c.exe	28
PID 1540 wrote to memory of 2692	1540	d79d03b4ac160fb01cf955786689271c.exe	28
PID 1540 wrote to memory of 2692	1540	d79d03b4ac160fb01cf955786689271c.exe	28

C:\Users\Admin\AppData\Local\Temp\d79d03b4ac160fb01cf955786689271c.exe
"C:\Users\Admin\AppData\Local\Temp\d79d03b4ac160fb01cf955786689271c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\d79d03b4ac160fb01cf955786689271c.exe
  C:\Users\Admin\AppData\Local\Temp\d79d03b4ac160fb01cf955786689271c.exe e6
  2⤵
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2692-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download